Some information management platforms provide advanced data discovery and protection services. For example, some Enterprise companies may implement data discovery and protection services to capture as much information regarding Enterprise data as possible in order to better model user behavior in the Enterprise, and then use that model to adjust the security policies and access policies of the Enterprise accordingly. In the context of information protection, it is generally becoming more critical for Enterprises to be able to support detailed information discovery operations, to conduct security audits, or even data forensics analysis operations. Conventional data discovery and protection solutions focus efforts on real-time protection, by directly monitoring user actions, data transfers, and implicit and explicit information flows. However, such traditional online techniques have limits to the amount of information that can be captured and cannot identify co-relations between users and data at the level of detail that is desired by Enterprises. For example, generally, conventional solutions do not provide a time perspective for information flowing through the Enterprise system. A greater granularity in tracking data typically cannot be achieved effectively by traditional online protection tools.